Super Useful Linux One-Liners

Here is a collection of super useful bash one-liners that resolve a hole world of issues you may encounter as a linux admin.

Bash one liners are a great way to get the most out of your terminal. With just a few characters you can do things like list all the files in a directory, create or delete directories, or copy files..

In this article, we’ll showcase some of our favorite bash one liners and show you how to use them.

Test If a Service is RUNNING or NOT_RUNNING

This Bash one-liner checks if a detached process is running on the server. In this example I am looking for a carbon black agent process called cbagentd is running, if it is, the command will output RUNNING, if it is not, the command will output NOT_RUNNING

ps -aux | grep /opt/carbonblack/psc/bin/cbagentd | grep -v grep && echo "RUNNING" || echo "NOT_RUNNING"

List Username and Sort by ID

This Bash One-Liner lists the users on your system and displays their Username and UserID. This is extremely useful when querying user accounts and amending permissions.

cut -d ':' -f 1,3 /etc/passwd | sort -t ':' -k2n - | tr ':' '\t'

Find out the Top 10 Most Used Commands.

Credit to TheGeekStuff for this one.

$ cat ~/.bash_history | tr "\|\;" "\n" | sed -e "s/^ //g" | cut -d " " -f 1 | sort | uniq -c | sort -n | tail -n 15

      1 history
      1 kill
      3 /opt/carbonblack/psc/bin/cbagentd
      4
      4 echo
      5 vi
     16 ps
     19 grep
     29 systemctl

Edit a File in Place

There are many use cases for editting existing files in place, you will need to master this command if you write infrastructure as code. You can litterally edit anything you want from a single command.

To test this, create 2 files with some basic content

sed -i 's#ORIGINAL_VALLUE#NEW_VALUE#g' myfile1 myfile2

root@ubuntu1:~# cat my*
hello world
testing123
root@ubuntu1:~# sed -i 's#hello#I love cats#g' myfile1 myfile2
root@ubuntu1:~# cat my*
I love cats world
testing123

Find Errors and Failures in Journalctl With Ease

If you have ever used journalctl you will know that the output is very verbose and to be honest, not that useful. It can be very hard to find the information you need especially if the log is huge. Try this cool onliner to break through all the noise.

journalctl --no-pager --since today \
--grep 'fail|error|fatal' --output json|jq '._EXE' | \
sort | uniq -c | sort --numeric --reverse --key 1

root@ubuntu1:~# journalctl --no-pager --since today \
--grep 'fail|error|fatal' --output json|jq '._EXE' | \
sort | uniq -c | sort --numeric --reverse --key 1
     59 "/usr/lib/systemd/systemd"
     16 null
     12 "/usr/bin/udevadm"
      4 "/usr/libexec/udisks2/udisksd"
      4 "/usr/bin/login"
root@ubuntu1:~#

Display Disk Partitions in JSON

lsblk --json | jq -c '.blockdevices[]|[.name,.size]'

root@ubuntu1:~# lsblk --json | jq -c '.blockdevices[]|[.name,.size]'
["loop0","63.2M"]
["loop1","48M"]
["loop2","135.7M"]
["sda","25G"]
["sr0","1024M"]

Find Duplicate files using file hash

This is a super simple way to search for duplicate files. It does so using by obtaining the hash of the files and comparing them. Each file found has an exact duplicate even if the file name is different. I use this command frequently to sort my music collection out, making sure I don’t have lots of duplicates.

find -not -empty -type f -printf "%s
" |  sort -rn |  uniq -d |  xargs -I{} -n1  find -type f -size {}c -print0 |  xargs -0  md5sum |  sort |  uniq -w32 --all-repeated=separate

Here is an example querying /etc

root@ubuntu1:/etc# find -not -empty -type f -printf "%s
" |  sort -rn |  uniq -d |  xargs -I{} -n1  find -type f -size {}c -print0 |  xargs -0  md5sum |  sort |  uniq -w32 --all-repeated=separate
0045f30dc1f17bb71be8f965442b1dc1  ./default/grub
0045f30dc1f17bb71be8f965442b1dc1  ./default/grub.ucf-dist

272913026300e7ae9b5e2d51f138e674  ./magic
272913026300e7ae9b5e2d51f138e674  ./magic.mime

370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/poweroff-vm-default
370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/poweron-vm-default
370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/resume-vm-default
370468e5f19a306e29d39fbf7b72cf08  ./vmware-tools/suspend-vm-default

Get Detailed Linux Distribution Information

Sometimes uname -a doesn’t give you everything you need

echo /etc/*_ver* /etc/*-rel*; cat /etc/*_ver* /etc/*-rel*

root@ubuntu1:/etc# echo /etc/*_ver* /etc/*-rel*; cat /etc/*_ver* /etc/*-rel*
/etc/debian_version /etc/lsb-release /etc/os-release
bookworm/sid
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.10
DISTRIB_CODENAME=kinetic
DISTRIB_DESCRIPTION="Ubuntu 22.10"
PRETTY_NAME="Ubuntu 22.10"
NAME="Ubuntu"
VERSION_ID="22.10"
VERSION="22.10 (Kinetic Kudu)"
VERSION_CODENAME=kinetic
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=kinetic
LOGO=ubuntu-logo
root@ubuntu1:/etc#

Find The Exact Date Of Your OS build

This is really useful if you use immutable instances, such as AWS instances or containers

fs=$(df / | tail -1 | cut -f1 -d' ') && tune2fs -l $fs | grep created

root@ubuntu1:/etc# fs=$(df / | tail -1 | cut -f1 -d' ') && tune2fs -l $fs | grep created
Filesystem created:       Sun Dec  4 08:46:38 2022

Monitor Open Netstat Connections

This handy one-liner lists all open netstat connections, this is useful when checking the connectivity of your server.

watch -n 1 "netstat -tpanl | grep ESTABLISHED"

Every 1.0s: netstat -tpanl | grep ESTABLISHED       ubuntu1: Sun Dec  4 20:12:26 2022

tcp6       0      0 192.168.2.39:22         192.168.2.213:58634     ESTABLISHED 937/s
shd: richard [

Watch CPU Processes

watch -n 1 'ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head'

Every 1.0s: ps -eo pid,ppid,cmd,%mem,%cpu --sor...  ubuntu1: Sun Dec  4 20:17:16 2022

    PID    PPID CMD                         %MEM %CPU
   1154       1 /usr/lib/snapd/snapd         3.1  3.2
    419       1 /sbin/multipathd -d -s       2.7  0.0
    657       1 /usr/bin/python3 /usr/share  2.1  0.0
   1994       1 /usr/libexec/packagekitd     2.0  0.0
    379       1 /lib/systemd/systemd-journa  1.3  0.0
      1       0 /sbin/init                   1.3  0.4
    637       1 /usr/libexec/udisks2/udisks  1.2  0.0
    660       1 /usr/sbin/ModemManager       1.1  0.0
    937     936 sshd: richard [priv]         1.0  0.0